View | Details | Raw Unified | Return to bug 28907
Collapse All | Expand All

(-)a/Koha/REST/V1/Checkouts.pm (-12 / +13 lines)
Lines 27-32 use Koha::Checkouts; Link Here
27
use Koha::Old::Checkouts;
27
use Koha::Old::Checkouts;
28
use Koha::Token;
28
use Koha::Token;
29
29
30
use Scalar::Util qw( blessed );
30
use Try::Tiny qw( catch try );
31
use Try::Tiny qw( catch try );
31
32
32
=head1 NAME
33
=head1 NAME
Lines 191-208 sub add { Link Here
191
    my $onsite    = $body->{onsite_checkout};
192
    my $onsite    = $body->{onsite_checkout};
192
    my $barcode   = $body->{external_id};
193
    my $barcode   = $body->{external_id};
193
194
194
    if ( $c->stash('is_public')
195
        && !C4::Context->preference('OpacTrustedCheckout') )
196
    {
197
        return $c->render(
198
            status  => 405,
199
            openapi => {
200
                error      => 'Feature disabled',
201
                error_code => 'FEATURE_DISABLED'
202
            }
203
        );
204
    }
205
206
    return try {
195
    return try {
207
196
208
        unless ( $item_id or $barcode ) {
197
        unless ( $item_id or $barcode ) {
Lines 215-220 sub add { Link Here
215
            );
204
            );
216
        }
205
        }
217
206
207
        if ( $c->stash('is_public') ) {
208
            $c->auth->public($patron_id);
209
210
            return $c->render(
211
                status  => 405,
212
                openapi => {
213
                    error      => 'Feature disabled',
214
                    error_code => 'FEATURE_DISABLED'
215
                }
216
            ) if !C4::Context->preference('OpacTrustedCheckout');
217
        }
218
218
        my $item;
219
        my $item;
219
        if ($item_id) {
220
        if ($item_id) {
220
            $item = Koha::Items->find($item_id);
221
            $item = Koha::Items->find($item_id);
(-)a/api/v1/swagger/paths/public_patrons.yaml (-2 lines)
Lines 130-137 Link Here
130
        description: Under maintenance
130
        description: Under maintenance
131
        schema:
131
        schema:
132
          $ref: "../swagger.yaml#/definitions/error"
132
          $ref: "../swagger.yaml#/definitions/error"
133
    x-koha-authorization:
134
      allow-owner: true
135
"/public/patrons/{patron_id}/guarantors/can_see_charges":
133
"/public/patrons/{patron_id}/guarantors/can_see_charges":
136
  put:
134
  put:
137
    x-mojo-to: Patrons#guarantors_can_see_charges
135
    x-mojo-to: Patrons#guarantors_can_see_charges
(-)a/t/db_dependent/api/v1/checkouts.t (-3 / +1 lines)
Lines 554-561 subtest 'add checkout' => sub { Link Here
554
        $t->post_ok( "//$userid:$password@/api/v1/public/patrons/$patron_id/checkouts" => json =>
554
        $t->post_ok( "//$userid:$password@/api/v1/public/patrons/$patron_id/checkouts" => json =>
555
                { item_id => $item1_id, patron_id => $patron_id } )->status_is(403)->json_is(
555
                { item_id => $item1_id, patron_id => $patron_id } )->status_is(403)->json_is(
556
            {
556
            {
557
                error                => "Authorization failure. Missing required permission(s).",
557
                error => "Unprivileged user cannot access another user's resources"
558
                required_permissions => undef
559
            }
558
            }
560
                );
559
                );
561
560
562
- 

Return to bug 28907